Anything that might affect tcp connection state: firewalls, load balancers, "smart” network gear.
Try tcpdumping the connection and look for TCP RST and or normal closures with FIN and the like.
You can also get a clue by using strace on syslog-ng, but tcpdump had more details.
Hello,
Our syslog-ng clients are losing their connection to our central log
server every few minutes.
In the client I have the following log:
2014-08-12T15:44:02+00:00 wimdu-app07 syslog.notice syslog-ng[14032]:
Syslog connection broken; fd='10', server='AF_INET(<our ip>:514)',
time_reopen='1'
2014-08-12T15:44:03+00:00 wimdu-app07 syslog.notice syslog-ng[14032]:
Syslog connection established; fd='10', server='AF_INET(<our ip>:514)',
local='AF_INET(0.0.0.0:0)'
I am using the following configuration on the clients:
destination d_net_wimdu {
syslog(<our ip>
transport("tcp")
port(514)
log-fifo-size(2048));
};
log { source(s_src); source(s_net); destination(d_net_wimdu); };
And on the server:
source s_net {
syslog(ip(0.0.0.0)
transport("tcp")
max-connections(300)
log-iw-size(3300)
so_rcvbuf(8000000000)
port(514));
};
log {
source(s_net);
destination(d_file_w);
};
destination d_prog_logparser {
program("< logparser_bin >"
template(t_w_filetemplate)
log_fifo_size(90000000)
flags(no-multi-line));
};
log {
source(s_net);
destination(d_prog_logparser);
flags(flow-control);
};
Any idea how I can even debug this?
Thank you
--
[image: Wimdu] <http://www.wimdu.com/>*Wimdu GmbH* - Voltastraße 5, 13355
Berlin, Germany
*Managing Directors* - Arne Bleckwenn, Hinrich Dreiling
*Commercial Register Number* - 129773 B Berlin[image: Contact]
<contact@wimdu.com>[image: Blog] <http://blog.wimdu.com/?wt_vi=signature>[image:
FB] <http://www.facebook.com/wimdu>[image: TW]
<http://www.twitter.com/wimdu>[image: G+] <http://www.google.com/+wimdu>[image:
YT] <http://www.youtube.com/wimtubechannel>[image: GH]
<https://github.com/wimdu>[image: LI]
<http://www.linkedin.com/company/wimdu-gmbh>[image: XI]
<http://www.xing.com/companies/wimdu>
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq